CVE-2026-22109
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
Risk Assessment
Known and unchanged default passwords allow an attacker to easily log in to the WebUI and take control of the device.
Recommendation
Immediately change all default WebUI account passwords and apply the vendor update that removes cleartext password storage.
Other vulnerabilities in WebUI
See all- CVE-2016-8494High
Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.
- CVE-2026-22110High
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
- CVE-2025-41692Medium
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Original NVD description (English source)
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS